Group Has Been Deleted Via Groupdel

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•1

Detects execution of the "groupdel" binary. Which is used to delete a group. This is sometimes abused by threat actors in order to cover their tracks